A path traversal flaw has been identified in the awxkit command‑line tool for Red Hat Ansible Automation Platform. The YAML !include directive fails to sanitize paths, enabling an attacker to supply a crafted YAML file that, when imported using "awx --conf.format yaml import", causes awxkit to read arbitrary YAML‑formatted files from the host filesystem. The vulnerability is client‑side and requires a user to execute awxkit against a malicious file; it does not permit code execution or denial of service. The flaw exposes the contents of any local file readable by the user, potentially leaking credentials or configuration information.

The vulnerability affects all Red Hat Ansible Automation Platform 2 installations that include the awxkit component. No specific patch level is mentioned, so every instance of the platform that has awxkit installed and is capable of importing YAML files is susceptible.

The CVSS score of 4.7 indicates a low to moderate severity. No EPSS data is available and the flaw is not listed in the CISA KEV catalog, implying no publicly known exploits. Exploitation requires a malicious YAML file to be presented to a user who then runs awxkit, so the risk is limited to scenarios where insider or socially engineered access can be achieved. Nevertheless, reading arbitrary files can lead to credential compromise and internal data leakage.